AI-driven pentesting is using AI models to find and chain software vulnerabilities. This cybersecurity news check covers the off-the-shelf model that chained 3 Chrome bugs — and your 60-second readiness quiz.
— Ingenious AI security check.
Closer than most teams assume. Researchers chained an off-the-shelf model's capabilities across three Chrome bugs into a working exploit — no novel model required. The readiness check below assumes attackers have the same tools: patch cadence, sandboxing, and whether your threat model still says ‘AI can't do that yet.’
Using AI models to find and chain software vulnerabilities the way a human penetration tester would — faster, and now shown working against real browsers.
In January, Oege de Moor, founder and CEO of XBOW — the $1B+ autonomous offensive-security startup — challenged his team to use AI to hack the world's most popular internet apps. During the Black Hat and DEF CON conferences (August 2–7), researcher Brendan Dolan-Gavitt and colleagues directed AI agents running OpenAI's publicly available GPT-5.6 Sol model to chain three previously unknown Chrome vulnerabilities into a single attack that ran code outside Chrome's sandbox on Windows — no click, no download. Google confirmed the chain, patched all three bugs, and paid its top $250,000 full-chain bounty — the first under its revised 2026 rules. Total compute cost: roughly $40,000. This 60-second check tests whether your defenses are built for AI-driven penetration testing at that speed. Free, no signup.
Answer honestly. Here, "Yes" is the safe answer.
This self-assessment is informational. It reflects the verified facts of XBOW's disclosed Chrome exploit chain and Google's response — it is not security or legal advice.
Industry pricing guides put a standard commercial penetration test at roughly $10,000 to $35,000. Smaller scoped web-application tests start around $5,000 to $7,500, and large or enterprise engagements run $35,000 to $150,000 or more, depending on scope, complexity, and retesting.
Between August 2 and 7, 2026, XBOW researcher Brendan Dolan-Gavitt and colleagues directed AI agents running OpenAI's publicly available GPT-5.6 Sol model to build a full Chrome-on-Windows exploit chain. The chain linked three previously unknown vulnerabilities — in Chrome's V8 JavaScript engine, its animated WebP image decoder, and Crashpad — crossing both of Chrome's sandboxes to run code with no click or download. The sprint cost roughly $40,000 in compute; Google confirmed, reproduced, patched all three bugs, and awarded its.
All three vulnerabilities are fixed and, per XBOW, were never exploited in the wild. The fixes shipped in Chrome 152.0.7977.65 (August 25, 2026) and 152.0.7977.82 (September 3, 2026). Chrome updates itself, but the fix only takes effect after the browser restarts — relaunch Chrome and confirm you are on 152.0.7977.82 or later.
The disclosure worked as intended — but the demo proves AI has compressed full exploit-chain development from months to days, using a publicly available model. Attackers have access to the same models. XBOW CEO Oege de Moor's defender takeaway: separate, even low-severity vulnerabilities can now be chained into a high-severity exploit path, so defenders must find and fix exploitable paths at a similar pace.
XBOW is an autonomous offensive security company based in Seattle, founded in January 2024 by Oege de Moor, the creator of GitHub Copilot and GitHub Advanced Security. In March 2026 it raised a $120 million Series C (led by DFJ Growth and Northzone), valuing it above $1 billion with $237 million total funding. In 2025 it became the first autonomous machine to top HackerOne's US leaderboard.
No. A free exposure check finds known, externally visible issues in minutes — missing patches, exposed services, known CVEs. A penetration tester goes deeper: chained exploits, business-logic flaws, authenticated testing, and a report auditors accept. Use the free check first, hire the tester for what only a human finds.